Encrypt Nuxeo password in database

[SMAH_Haider]

We are using Nuxeo 5.6-RC2. We are connecting via oracle template. We have also customized nuxeo to use our customized pre-made users instead default nuxeo users.

Now, username and password Administrator and Administrator are placed in MY_CUSTOMIZED_USERS table, and obviously they are not encrypted. In production environment, users have access to database and they can see Administrator password.

Is there anyway we can customize Nuxeo to have our login passwords in database encrypted?

[Wojciech_Sulejm · Accepted solution]

Only the initial Administrator password, that is the word "Administrator", is not encrypted as the assumption was made that it needs to be reset anyway to make it secure. The moment you change the Administrator password, it does get encrypted.

Please make a test and change your Administrator password and then query the users table to see if that indeed is the case.

[SMAH_Haider]

Thanks Wojciech I changed the password and as you said it got encrypted in database. But as we have made our custom users by making our own user directory.

[Florent_Guillau]

If <passwordHashAlgorithm>SSHA</passwordHashAlgorithm> is in the config then Nuxeo will encrypt any password it writes, but will still be able to read unencrypted ones.

If you populate the password database using an external system, then you'll have to do the encryption yourself. You can see how SSHA is implemented by reading the code at https://github.com/nuxeo/nuxeo-services/blob/master/nuxeo-platform-directory/nuxeo-platform-director...

[SMAH_Haider]

Perfect. Thanks Florent.